WHITE PAPER Payment Security Solution Processor Edition For retail and e-commerce card processing environments Introduction This white paper describes Voltage Payment Security Solution Processor Edition which includes point-to-point encryption (P2PE) and patent-pending Voltage Secure Stateless Tokenization for both card-present (CP) and card-not-present (CNP) processing environments. Voltage Payment Security Solution Processor Edition is a complete security solution for protecting cardholder data from the moment of capture at the consumer endpoint until it reaches the payment processor. By providing persistent data-level protection, Voltage Payment Security Solution Processor Edition enables protection not only for authorization and settlement data flows but also for back office applications and processes that touch cardholder data. Through the use of unique Voltage technologies, Voltage Payment Security Solution Processor Edition eliminates the traditional complexities associated with key injection, key management, and deployment, while reducing PCI DSS scope dramatically. Voltage Security Technology Leadership Voltage Security simplifies data protection with innovations such as: Voltage Identity-Based Encryption (IBE), for key management without public key infrastructure (PKI) and Voltage Format-Preserving Encryption (FPE), a technique which renders data useless to attackers yet still useful to business processes; Voltage Page-Integrated Encryption (PIE) for securing browser-based transactions; and patent-pending Voltage Secure Stateless Tokenization (SST) for protecting data at rest. Voltage Security protects data in transactions, fields, files, applications, databases, and back office workflows from legacy applications to cutting-edge cloud systems. Among Voltage customers are 5 of the 7 top US payment processors including Heartland Payment Systems and Vantiv, thousands of retailers, and a top payment gateway in both Europe and the US. Voltage payment security partners include leading device manufacturers such as Ingenico and Equinox. The Payment Security Challenge In the last few years there have been dramatic changes in the payment ecosystem. Many of the changes relate to security or the lack of security throughout the payment ecosystem. Exploitation of security vulnerabilities resulted in well-publicized data breaches that damaged consumer confidence and ensured regulatory compliance with Payment Card Industry Data Security Standard (PCI DSS) remains an expensive and time consuming activity. The impact of payment ecosystem changes and the resulting regulations have reduced business agility for acquirers, payment gateways, merchants and others. It is essential to protect cardholder data against threats by using technologies, such as point-to-point encryption for protecting cardholder data from capture all the way through to the processor and tokenization for protecting post authorization cardholder data.
Today s challenges can be characterized as: Defending from data breaches by criminal attackers: Sophisticated attacks to obtain cardholder data by well-funded criminal hacking groups are increasingly common. Since stolen data can quickly be transformed into cash, breaches will increase in scale and velocity if unchallenged. The industry s attempts to prevent such attacks from a traditional IT security perspective have failed as evidenced by the number of breaches that happen every day. Reduction or elimination of costs to comply with PCI DSS: There is an overwhelming desire to reduce costs and complexity involved in achieving and validating compliance with PCI DSS. At the same time, it must be understood that PCI compliance does not mean data security. Investments must be made to reduce security risk as well as compliance costs. Lower operating margins: Spending on PCI DSS compliance is a barrier to business growth as funds being spent on compliance and validation are unavailable for investment in core competencies and innovation. A desire to extend existing infrastructure for maximum lifespan: Existing IT platforms are reaching their acceptable risk thresholds in light of new persistent threats. Given the reality of today s economic pressures, the ability to extend infrastructure lifespan without sacrificing security is needed. The rise of new payment and customer service channels: Consumers can no longer be forced to transact with a merchant through a single channel. Merchants must secure m-commerce, e-commerce and retail POS endpoints to compete in today s marketplace and to do so effectively and efficiently. Unique Voltage Security Technology Voltage Payment Security Solution Processor Edition is built on breakthrough cryptographic technologies: Voltage Format-Preserving Encryption (FPE) and Voltage Identity-Based Encryption (IBE). FPE and IBE combine with Voltage Secure Stateless Tokenization (SST) and Voltage Page-Integrated Encryption (PIE) to create a unique security solution that addresses the challenges associated with the payment ecosystem which traditional security approaches cannot address. Format-Preserving Encryption Format-Preserving Encryption, or FPE, is a symmetric key technology based on AES that allows for structured data to be strongly encrypted while maintaining its original format. For example, a 16-digit credit card number can be encrypted such that the resulting output is also 16 digits. In addition, internal properties of the data such as checksums can be maintained; the encrypted 16-digit value can be guaranteed to have a valid Luhn checksum (or, if desired, an invalid checksum). Unlike other approaches, Voltage FPE is not limited in the data sizes that can be encrypted. For example, other implementations may require a full Primary Account Number (PAN), or often times a full track, in order to encrypt. FPE can handle any data size, from a subset of digits up to long strings of text. This allows for sub-elements of the PAN, such as the middle 6 digits, to be encrypted in isolation, while maintaining the rest of the PAN or track in the clear, without sacrificing encryption strength. Figure 1: Format-Preserving Encryption illustration showing the format of the credit card being preserved in two examples. Additionally, FPE is not restricted to use for encrypting numeric values; it can be applied to structured data of any type, including alphanumeric fields, decimal values, and dates. FPE is backed by a strong security proof that validates that it has the same security as the underlying block cipher, AES. Identity-Based Encryption IBE is a public-key algorithm that eliminates the primary complexity associated with traditional PKI systems: digital certificates. Like existing
public-key systems such as RSA, IBE employs separate encryption (public) and decryption (private) keys. IBE, however, allows an arbitrary string to be used directly as a public key, while the private key is generated mathematically by a key server. Thus, rather than needing to use a digital certificate to associate a public key with a recipient (e.g., recipient@domain.com ), IBE allows that recipient s identifier to be used directly for encryption. This capability eliminates the need for certificate generation, issuance, distribution, and revocation, resulting in a key management architecture that is far easier to deploy and manage. Figure 2: The use of FPE and IBE technology combined in enabling point-to-point protection of data from capture to hand off. Voltage Payment Security Solution Processor Edition extends the use of IBE to enable powerful yet flexible key management architecture for point-to-point encryption at processor grade scale. Voltage Encryption Key Management Unlike traditional key management architectures which are highly stateful and require continuous backup, replication, and management of randomly-generated keys, Voltage key management is completely stateless. Keys are generated on-demand using a Key Derivation Function (KDF), reducing the need to cache or store keys on the server. This design enables a secure architecture that is dramatically more scalable and requires far less maintenance than legacy systems. Identity-Based Key Encapsulation and Encryption Protocol (IBKEEP)- An Injectionless Encryption Protocol The combination of FPE and IBE creates a convenient protocol which can permit point-to-point encryption of cardholder data while minimizing key management overhead. This protocol is referred to as IB-KEEP. IB-KEEP eliminates the pain of key injection by minimizing changes to existing infrastructure and codebases. There is a diverse set of transaction initiation points that capture and transmit cardholder data. The IB-KEEP protocol aims to protect cardholder data in existing environments, acknowledging that systems without dedicated security hardware are inherently vulnerable to attacks. We classify these systems into three groups: Hardware with tamper-resistant security module (TRSM)/ Secure Cryptographic Device (SCD). These are POS devices (typically terminals) capable of running security code in a mode where the payment application on the device is incapable of altering the operation of the security code, or reading the memory of the security code. On these devices, PAN data passes directly from the reading device (mag stripe reader or keypad) to the security code. Hardware without tamper-resistant security module (TRSM)/ Secure Cryptographic Device (SCD). These are devices, often running in a fixed-function manner, that do not have full isolation between the application code that generates payment messages and the hardware running the security code. Software. These are devices (typically PCs) running POS applications that accept PAN data input from a stock keyboard or from an
unsecured magnetic stripe reader. Voltage Payment Security Solution Processor Edition Implementation Voltage Payment Security Solution Processor Edition is a suite of products and provides all of the necessary components to protect cardholder data at consumer capture all the way through to processing host. The products are: Voltage SecureData Payments Voltage SecureData Web Voltage SecureData Enterprise with Secure Stateless Tokenization The kit includes: SDKs to encrypt CP and CNP cardholder data at capture, and back-end host-side decryption tools and SST technology. POS SDK for retail and e-commerce The POS SDK is highly portable and is designed to operate with minimal hardware requirements. On a physical POS terminal, the Voltage SecureData Payments POS SDK may be implemented either at the operating system or firmware layer or within the software application. Implementing within the operating system can allow for sensitive data to be hidden from the software application thus reducing PCI scope. However, in cases where implementation in the operating system is difficult or infeasible, the SDK can be integrated into the application without compromising security: because keys are never stored (and can be rotated on-demand), TRSM or SCD-based symmetric key storage is not required. The POS SDK s approach of using FPE and IBE together to eliminate static key injection and storage issues are preferred. However, the POS SDK can also adopt alternative key management approaches with software adjustment and corresponding key management processes for key injection. This flexibility permits the POS SDK to be adapted to any scenario, and capabilities can be combined to permit migration to lower cost approaches in timescales suited to merchant hardware refresh cycles. Page Integrated Encryption technology for card-not-present processing PIE technology in Voltage SecureData Web handles encryption in e-commerce environments, including virtual terminals and shopping cart software. PIE builds upon FPE and stateless key management to encrypt cardholder data entered into browsers on any device from capture Fig 3: Voltage SecureData e-commerce protection
all the way through to decryption for processing. Cardholder data remains encrypted as it moves through the merchant s environment such that plaintext data is not exposed to the merchant. Merchants retain full control over their consumer checkout process and avoid third- party hand offs which can result in consumer abandonment of the checkout process. Host Decryption SDK On the back-end, Voltage provides a rich set of integration capabilities to enable decrypting of data encrypted with the Voltage SecureData Payments POS SDK and Voltage SecureData Web. The Voltage SecureData Payments Host SDK provides an integration toolkit as pre-built libraries available on z/os, Stratus VOS, HP Non- Stop and various UNIX, Windows and Linux platforms. This API permits decryption of incoming cardholder data, resolves incoming keys for decryption of data and can re-encrypt PAN data for local storage in a normalized fashion. Decryption and re-encryption operations take place inside the physical confines of an HSM. Secure Stateless Tokenization Technology Voltage offers fully integrated tokenization capability to protect cardholder data that must be stored for back-office operations and follow-on transactions. Voltage SecureData Enterprise with Voltage Secure Stateless Tokenization (SST) does not index tokens on a database; rather token tables are pre-generated and operate in system memory. The pre-generated token table can reside in multiple data centers to ensure that the same token is returned for any given PAN regardless of which data center processes the transaction. Since tokens are created in memory and no read-write operations occur, Voltage solution offers a significant performance advantage over traditional tokenization deployments. Fig 4: Generalized payment flow with cardholder data encryption and tokenization SST solves the token collision problem that can occur with traditional tokenization deployments in high-availability processing environments with more than one data center.
Benefits of Voltage Payment Security Solution Processor Edition Component Protects Scope Reduction Voltage SecureData Payments POS SDK for card-present processing Voltage SecureData Web Page Integrated Encryption technology for card-not-present processing Voltage SecureData Enterprise Secure Stateless Tokenization technology CHD in motion (transmitted, processed) CHD in motion (transmitted, processed) CHD at rest (stored) Up to 79% scope reduction for merchants using dialup connections Up to 69% scope reduction for merchants using an IP connection Up to 100% scope reduction Can completely remove the merchant s CNP system from scope Up to 100% scope reduction in terms of PCI DSS requirements 3 and 9 Voltage Payment Security Solution Processor Edition has been independently validated to reduce scope and costs of compliance of up to 79%1 in CNP environments, and up to 100% PCI scope reduction can be achieved, as assessed independently by Coalfire, an industryleading QSA. Reduction in Operational Costs and Complexity No Key Injection: Through the use of IBE, Voltage Payment Security Solution- Processor Edition eliminates the need for key injection. Encryption keys are dynamically generated by the terminal and can be rotated on demand. Stateless Operation: Unlike other architectures, Voltage s key management is completely stateless: encryption keys never need to be stored, replicated, or backed up. This enables a key management system that is far easier to deploy and far easier Voltage is delivering powerful to maintain and manage. scope and cost reducing benefits Robust Host-Side Capabilities Broad Platform Support: Voltage offers native encryption and decryption capabilities on a wide variety of platforms, including Windows, Linux, UNIX, and z/ OS. This breadth of coverage provides for the highest performance, as decryption of data can take place on existing systems, without introducing network latencies and for maximum flexibility to adapt to complex use cases and risk requirements. Multiple Integration Options: By providing multiple integration choices, including SDKs, HSM options, web services, and command line tools, Voltage Payment Security Solution- Processor Edition enables encryption to be incorporated into a wide variety of systems. Thus, protection can be extended beyond authorization and settlement to all applications interfacing with PCI data. with PIE, that give merchants new flexibility in accepting payments securely. Voltage s advancements in this area, combined with growing market awareness, will quickly establish them as the market leader in secure e-commerce payments. Coalfire President Kennet Westby Multiple Data Protection Options: With built-in encryption using standard AES, format-preserving AES (FFX mode AES), IBE and bulk encryption, randomly generated tokens and token vaults, file encryption for whole files, field level encryption, or COBOL Copybook format data encryption, Voltage provides a complete range of protection options under one system maximizing ROI and use case, with the flexibility to switch between methods by policy.
Architectural Flexibility Support for Multiple Decryption Points: In encryption systems that encompass both a processor and a large merchant, there may be a need for multiple decryption points, so that both parties have the host-side ability to access PAN data for various existing processes. Voltage s key management architecture provides the ability for many decryption endpoints, without the need for key exchange or synchronization. Portable Terminal Implementation: Voltage s front-end terminal implementation is platform agnostic, enabling encryption from any environment where credit card data is acquired, including physical terminals, ECR systems, virtual terminals, and CNP environments. This flexibility is critical in large merchant environments, where credit card data may enter the system in a variety of ways. Encryption Without Restrictions: Voltage s FPE allows for data of arbitrary length and format to be encrypted in isolation, unlike other approaches with often require additional track information or metadata. This capability is critical for operations like manual card entry or terminal-based settlement, where only a Primary Account Number (PAN) is available, and allows for encryption of only selected digits of a PAN. Key Management Agility: The flexible nature of the toolkit permits alternative key management architectures to be adopted through software adjustments. This permits the maximum flexibility to suit particular use cases and constraints of the underlying environment. For more details or to arrange a review and technical workshop, please contact info@voltage.com. About Voltage Security Voltage Security, Inc. is the leading data protection provider, delivering secure, scalable, and proven data-centric encryption and key management solutions, enabling our customers to effectively combat new and emerging security threats. Leveraging breakthrough encryption technologies, our powerful data protection solutions allow any company to seamlessly secure all types of sensitive corporate and customer information, wherever it resides, while efficiently meeting regulatory compliance and privacy requirements For more information, please visit www.voltage.com. Voltage Security, Inc., Voltage Identity-Based Encryption (IBE), Voltage SecureMail, Voltage Format-Preserving Encryption (FPE), Voltage SecureMail Mobile Edition, Voltage Page-Integrated Encryption (PIE), Voltage SecureMail Application Edition, Voltage Secure Stateless Tokenization (SST), Voltage SecureMail ediscovery Compliance Tool, Voltage Identity-Based Symmetric Encryption, Voltage SecureMail Archive Connector, Voltage SecureMail Statement Generator Service, Voltage SecureMail Cloud, Voltage SecureData, Voltage SecureData Command Line, Voltage SecureData Simple API, Voltage SecureData Enterprise, Voltage SecureData z/protect, Voltage SecureData Payments, Voltage SecureFile, Voltage SecureData Web, Voltage Cloud Services are registered trademarks of Voltage Security or are trademarks of Voltage Security or are service marks of Voltage Security, Inc. All other trademarks are property of their respective owners. v03262013